> dfxlibs -h
  usage: dfxlibs [-h] [-m META_FOLDER] [-s SCAN_DIR] [--meta_create] [-i IMAGE [IMAGE ...]]
                 [--bde_recovery BDE_RECOVERY] [--part PART] [-pevtx] [-pf] [-pvss]
                 [--hash HASH [HASH ...]] [--filetypes] [-ppf] [-preg] [-plnk] [-pusn] [-cevtx] [-cpf]
                 [-clnk] [-cusn] [--analyze_start ANALYZE_START] [--analyze_end ANALYZE_END] [-aar]
                 [-ardp] [-asi] [-aut] [-aui] [-sfn SCAN_FILENAME] [-sft SCAN_FILETYPE]
                 [-shl SCAN_HASHLIST] [-e EXTRACT [EXTRACT ...]] [-lp]

  dfxlibs: A python digital forensics toolkit (version 0.1.0)

  optional arguments:
    -h, --help            show this help message and exit

  General Arguments:
    These parameters are used in all categories.

    -m META_FOLDER, --meta_folder META_FOLDER
                          folder to store and load meta information for one image
    -s SCAN_DIR, --scan_dir SCAN_DIR
                          folder to scan for meta folders. Used for scan options
    --meta_create         create meta information folder if not exists
    -i IMAGE [IMAGE ...], --image IMAGE [IMAGE ...]
                          forensic image file. This parameter is stored in the meta information folder,
                          so it is only needed for the first call on an image. If this parameter is
                          given on proceeding calls, it will overwrite the parameter in the meta
                          information folder (so be careful to not mix up different images in one meta
                          information folder).
    --bde_recovery BDE_RECOVERY
                          Bitlocker recovery key for bitlocker encrypted volumes
    --part PART           Specify partition for actions like --prepare_files. It must be named as given
                          in the --list_partitions output. Without --part all partitions in an image
                          will be included.

  Preparation:
    These arguments prepare the data from the image for further analysis

    -pevtx, --prepare_evtx
                          read all windows evtx logs in a given Image and stores them in a sqlite
                          database in the meta_folder. You can specify a partition with --part.
    -pf, --prepare_files  Scan files and directories of all partitions. You can specify a partition with
                          --part. The file entries will be stored in the meta_folder in a sqlite
                          database
    -pvss, --prepare_vss  Scan for files and directories in volume shadow copies of all partitions. You
                          can specify a partition with --part. The file entries will be stored in the
                          meta_folder in a sqlite database
    --hash HASH [HASH ...]
                          Hash all files <256 MiB of all partitions. You can specify a partition with
                          --part. Possible algorithms are md5, sha1, sha256 and tlsh. A minimum filesize
                          of 50 bytes is required for tlsh. The result is stored in the file database.
    --filetypes           turn on signature based detection of filetypes of all files in all partitions.
                          The result is stored in the file database. You can specify a partition with
                          --part.
    -ppf, --prepare_prefetch
                          reading prefetch files and stores the entries in a sqlite database in the
                          meta_folder. You can specify a partition with --part.
    -preg, --prepare_reg  read the windows registry and stores them in a sqlite database in the
                          meta_folder. You can specify a partition with --part.
    -plnk, --prepare_lnk  reading lnk files and stores the entries in a sqlite database in the
                          meta_folder. You can specify a partition with --part.
    -pusn, --prepare_usn  reading ntfs usn journals and stores the entries in a sqlite database in the
                          meta_folder. You can specify a partition with --part.

  Carving:
    These arguments are for different carving options.

    -cevtx, --carve_evtx  carve for windows evtx entries and stores them in the same database as for the
                          --prepare_evtx argument
    -cpf, --carve_prefetch
                          carve for prefetch files and stores them in the same database as for the
                          --prepare_prefetch argument
    -clnk, --carve_lnk    carve for lnk files and stores them in the same database as for the
                          --prepare_lnk argument
    -cusn, --carve_usn    carve for ntfs usn journal entries and stores them in the same database as for
                          the --prepare_usn argument

  Analyze:
    These arguments are for in-depth analysis of the image.

    --analyze_start ANALYZE_START
                          Specify a start date in format YYYY-MM-DD for event based analysis (e.g.
                          logins). Only events after or equal the given date are analyzed.
    --analyze_end ANALYZE_END
                          Specify a end date in format YYYY-MM-DD for event based analysis (e.g.
                          logins). Only events before or equal the given date are analyzed.
    -aar, --analyze_autoruns
                          list different autorun jobs
    -ardp, --analyze_rdp_sessions
                          list rdp sessions from system logs
    -asi, --analyze_sys_infos
                          list multiple system information
    -aut, --analyze_uptimes
                          list timeranges, when the system was up and running. Up and running is defined
                          by at least one eventlog entry within 60 minutes
    -aui, --analyze_user_infos
                          list multiple user information

  Scan:
    These arguments are for scanning multiple images for search parameters.

    -sfn SCAN_FILENAME, --scan_filename SCAN_FILENAME
                          scan for matches for given filename. "%" (any sequence of zero or more
                          characters) and "_" (single character) can be used as wildcards
    -sft SCAN_FILETYPE, --scan_filetype SCAN_FILETYPE
                          scan for matches for given filetype
    -shl SCAN_HASHLIST, --scan_hashlist SCAN_HASHLIST
                          scan for matches from given hashlist file (one hash per line)

  Special actions:
    These parameters contains short and simple actions.

    -e EXTRACT [EXTRACT ...], --extract EXTRACT [EXTRACT ...]
                          Extracts files from the image and stores them to the meta_folder. You have to
                          give the full path and filename (with leading slash - even slashes instead of
                          backslashes for windows images) or a meta address. As default source
                          "filesystem" for regular files in the image will be used. You can give another
                          file-source (e.g. "vss#0" for shadow copy store 0) by just adding it in front
                          of your path and separate it with a colon (e.g. "vss#0:/path/testfile.txt" for
                          /path/testfile.txt from vss#0). You can give multiple files at once
    -lp, --list_partitions
                          print partition list